If you are a state actor you probably love M1 Macs. You literally can't restore them without phoning home.

Everone should consider state actors as a threat because they are. They maybe are not specifically after you. But every now and then some big box gets popped leaking all kinds of personal information (including yours) and the actors are probably state sponsored. Also it is not state actors scanning your data, many cloud providers do so.

If you have a state actor as threat model you probably want to remove iCloud backups (see link):

"Apple’s iCloud, on the other hand, can be searched in secret. In the first half of last year, the period covered by Apple’s most recent semiannual transparency report on requests for data it receives from government agencies, U.S. authorities armed with regular court papers asked for and obtained full device backups or other iCloud content in 1,568 cases, covering about 6,000 accounts."

Your concerns are not unfounded, but there is a very significant functional difference between being generally concerned about data privacy posed by any third-party bad actor, and having a threat profile that includes specific state actor threats.

If you think it is a realistic scenario that the US would serve a warrant against you, then yes, your iCloud backup will probably be disclosed to the authorities. But if this is a real concern of yours, then you probably have much bigger things to worry about than whether your SSD is soldered to the board or not.

It feels like you're using "state actor" as a motte and bailey. It usually means targeted espionage affecting very few, with strong motives for why security services are interested in them specifically. Whereas that article is ultimately talking about a dragnet surveillance system, which is technically a state actor but affects literally everyone.

I don't mean anything special by "state actor", I plainly mean: actions taken by a state.

Whether you consider those actions to be a threat would depend on an individual person's or organization's assessment of the impact of those actions.

Using your loose definition of "state actor" means that every single person who uses mainstream cloud solutions has "state actor" as a threat, whether they acknowledge it or not. It's not just the occasional person super focused on security as you're making it out to be - in fact people less in touch with security have a larger threat from their system being hijacked and used to distribute contraband bits, thereby running afoul of cloud scanning.

No it doesn't mean that, because threat assessments consist of multiple variables, including the footprint, probability, and impact of a potential threat.

That's a fancy way of saying "I've got nothing to hide".

No it's not. Consider the risk that a street criminal could throw a rock through my window and steal my computer off of my desk. Do I put bars on my window? No. Why? Because I have nothing to hide? No, because I don't consider that attack vector to be a high enough priority that I need to take steps to mitigate it.

Threat assessments are purely an engineering exercise. This is orthogonal to the ethical, philosophical, and political discussion of civil liberties. If you have ethical, philosophical, or political concerns about this topic, those are something to be addressed in their respective realms. It is naïve to believe that engineers have power to protect anyone from abuses of civil liberties. Apple hardware engineering team is neither capable nor equipped to be addressing these concerns in their designs.